General
-
Target
PONYDOODOO.png
-
Size
186KB
-
Sample
241102-yb75pstekn
-
MD5
868076ce3956526083cf3f29bf156c2c
-
SHA1
432d9335d2cb2dee2dde6f6301ae3349e3d239b7
-
SHA256
7682efae2c4916c1750fe643fd85f2fdc2b8209e2fedb8691b4612a811e61ce5
-
SHA512
49481e1bae76ba838f7e006f960c6f5bff5978317c5f3b4905effefde8c65394aacf91c9ad465816a08b279aa4cc81c28e4fbd01859bc59935a7fb0e08bd13d8
-
SSDEEP
3072:snx5651LC8bLMxnBozjxGPwgbKwLZfoNTtd3SP4AuD2Nrn0ZqeYm/zvyQbpCkef:x+8bLMxnBozQPwyKwltVxnkYm/zvFbpu
Static task
static1
Behavioral task
behavioral1
Sample
PONYDOODOO.png
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
PONYDOODOO.png
-
Size
186KB
-
MD5
868076ce3956526083cf3f29bf156c2c
-
SHA1
432d9335d2cb2dee2dde6f6301ae3349e3d239b7
-
SHA256
7682efae2c4916c1750fe643fd85f2fdc2b8209e2fedb8691b4612a811e61ce5
-
SHA512
49481e1bae76ba838f7e006f960c6f5bff5978317c5f3b4905effefde8c65394aacf91c9ad465816a08b279aa4cc81c28e4fbd01859bc59935a7fb0e08bd13d8
-
SSDEEP
3072:snx5651LC8bLMxnBozjxGPwgbKwLZfoNTtd3SP4AuD2Nrn0ZqeYm/zvyQbpCkef:x+8bLMxnBozQPwyKwltVxnkYm/zvFbpu
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Modifies file permissions
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
3Pre-OS Boot
1Bootkit
1